Auth0 Logs (Beta)
Panther supports receiving Auth0 logs directly via webhook
Auth0 log ingestion is in open beta starting with Panther version 1.73, and is available to all customers. Please share any bug reports and feature requests with your Panther support team.
Panther ingests Auth0 tenant logs by configuring Auth0's log streaming service to post events to a Panther HTTP source.
- 1.In the left-side navigation bar of your Panther Console, click Configure > Log Sources.
- 2.Click Create New.
- 3.Search for “Auth0,” then click its tile.
- In the slide-out panel, the Transport Mechanism dropdown in the upper-right corner will be pre-populated with the HTTP option.
- 4.Click Start Setup.
- 5.
- During setup, on the security configuration page, you will be required to use bearer authentication; this is the only method of authentication Auth0 supports. You can generate a token value by clicking the circular arrows, or supply your own.
- 1.Log in to your Auth0 tenant.
- 2.From the dashboard, navigate to Monitoring > Streams.
- 3.Click Create Stream.
- 4.Select Custom Webhook.
- 5.Give your Event Stream a descriptive name, e.g.,
Panther Log Stream. - 6.In the Payload URL field, paste the URL for the Auth0 HTTP source in Panther you generated in the previous step of this process.
- 7.In the Authorization Token field, enter the bearer token you used when setting up the Auth0 source in Panther, in the previous step of this process.
- Enter this value in the form
Bearer <token value>.
- 8.Click Save.
Required fields in the schema are listed as "required: true"
Auth0.Events are event logs from the Auth0 log stream. For more information, see Auth0's documentation on tenant log events.
schema: Auth0.Events
description: Event logs from Auth0 Log Stream
referenceURL: https://auth0.com/docs/deploy-monitor/logs
fields:
- name: log_id
required: true
description: The ID of the log.
type: string
- name: data
required: true
description: The data object containing information about the log.
type: object
fields:
- name: date
description: Date/Time when the event occurred.
type: timestamp
timeFormats:
- rfc3339
isEventTime: true
- name: type
description: Type of event.
type: string
- name: description
description: Description of this event.
type: string
- name: connection
description: Name of the connection the event relates to.
type: string
- name: connection_id
description: ID of the connection the event relates to.
type: string
- name: client_id
description: ID of the client (application).
type: json
- name: client_name
description: Name of the client (application).
type: string
- name: ip
description: IP address of the log event source.
type: string
indicators:
- ip
- name: hostname
description: Hostname the event applies to.
type: string
- name: user_id
description: ID of the user involved in the event.
type: string
indicators:
- username
- name: user_name
description: Name of the user involved in the event.
type: string
indicators:
- username
- name: audience
description: API audience the event applies to.
type: string
- name: scope
description: Scope permissions applied to the event.
type: string
- name: strategy
description: Name of the strategy involved in the event.
type: string
- name: strategy_type
description: Type of strategy involved in the event.
type: string
- name: details
description: Additional useful details about this event (structure is dependent upon event type).
type: json
- name: log_id
description: Unique ID of the event.
type: string
- name: is_mobile
description: Whether the client was a mobile device (true) or desktop/laptop/server (false).
type: boolean
- name: user_agent
description: User agent string from the client device that caused the event.
type: string
- name: location_info
description: Information about the location that triggered this event based on the IP.
type: object
fields:
- name: country_code
description: Two-letter Alpha-2 ISO 3166-1 country code.
type: string
- name: country_code3
description: Three-letter Alpha-3 ISO 3166-1 country code.
type: string
- name: country_name
description: Full country name in English.
type: string
- name: city_name
description: Full city name in English.
type: string
- name: latitude
description: Global latitude position.
type: float
- name: longitude
description: Global longitude position.
type: float
- name: time_zone
description: Time zone name as found in the tz database.
type: string
- name: continent_code
description: Two-letter continent code.
type: string
Last modified 13d ago